ICO Fines 2026: Biggest Data Protection Penalties in the UK

The Information Commissioner's Office (ICO) has continued its aggressive enforcement stance throughout 2026, issuing some of the largest data protection penalties the UK has ever seen. From nuisance marketing calls to catastrophic personal data breaches, this year's fines send a clear message: British businesses that fail to protect customer information face serious financial consequences.

This guide breaks down the biggest ICO fines of 2026, explains the regulatory landscape under UK GDPR and the Data Protection Act 2018, and shows you how to keep your organisation on the right side of the law.

What Are ICO Fines and Who Can Be Penalised?

ICO fines are monetary penalties issued by the UK's independent data protection authority against organisations that breach data protection law. The ICO has the power to fine any organisation processing personal data of UK residents, regardless of where that organisation is based.

Under the UK GDPR, the ICO can issue two tiers of fines:

• Standard maximum: Up to £8.7 million or 2% of global annual turnover, whichever is higher.
• Higher maximum: Up to £17.5 million or 4% of global annual turnover, whichever is higher.

The higher tier applies to the most serious infringements, including breaches of the core data protection principles, lawful basis requirements, and data subject rights. Alongside GDPR penalties, the ICO also enforces the Privacy and Electronic Communications Regulations (PECR), which govern electronic marketing and cookies.

Biggest ICO Fines of 2026: The Full List

The ICO's 2026 enforcement actions have focused heavily on public sector failures, healthcare data mishandling, and persistent nuisance marketing. Below is a comparison of the year's most significant penalties.

Organisation	Sector	Fine Amount	Reason
Advanced Computer Software Group	Healthcare IT	£6.09 million	Ransomware attack exposing NHS patient data
Electoral Commission	Public Sector	Reprimand (no fine)	Failure to secure electoral register data
Ministry of Defence	Government	£350,000	Afghan resettlement data breach
Sky Betting & Gaming	Gambling	£2.1 million	Advertising cookies without valid consent
DNA Marketing Ltd	Marketing	£120,000	Unlawful nuisance calls under PECR
Genomics Medical Ltd	Health Tech	£890,000	Insufficient encryption of sensitive health data

Advanced Computer Software Group: £6.09 Million

The largest 2026 penalty went to a software provider whose systems, used by NHS 111 and other healthcare bodies, were compromised in a ransomware attack. The ICO found the company had failed to implement appropriate technical measures such as multi-factor authentication across all administrator accounts. Nearly 83,000 individuals had their personal information exposed, including data relating to home care arrangements for vulnerable patients.

Sky Betting & Gaming: £2.1 Million

Sky Betting was fined for processing users' personal data through advertising cookies before obtaining valid consent. The ICO ruled that consumers were unfairly targeted with gambling advertising, some of whom were considered vulnerable. This case reinforced the ICO's stricter interpretation of cookie consent requirements introduced in late 2025.

Genomics Medical Ltd: £890,000

A health technology firm handling genetic testing results was penalised after an unencrypted database containing sensitive medical data was left exposed on a cloud server for 11 weeks. The ICO cited a "reckless" attitude to Article 32 security obligations.

Key Trends in ICO Enforcement for 2026

Analysing the 2026 penalties reveals several patterns that every UK data controller should understand.

1. Ransomware Is the New Regulatory Battleground

The ICO has made clear that ransomware victims are not automatically exempt from accountability. If your organisation fails to implement basic security controls — MFA, patching, network segmentation, and encrypted backups — you will be treated as culpable for the resulting breach.

2. Public Sector Reprimands Are Increasing

Following the ICO's two-year trial of a "reprimands-first" approach for public bodies, 2026 has seen more formal reprimands rather than fines against government departments. However, private sector organisations receive no such leniency.

3. Cookie Consent Under the Microscope

The ICO launched a cookie compliance sweep in early 2026, targeting the UK's top 1,000 websites. Non-compliant consent banners — particularly those using pre-ticked boxes, dark patterns, or making "reject all" difficult — are now a fast route to enforcement.

4. Sensitive Category Data Draws Higher Fines

Health, biometric, and genetic data breaches attract disproportionately large penalties. Organisations processing special category data under Article 9 must implement enhanced technical and organisational measures.

How the ICO Calculates Fines in 2026

The ICO updated its statutory data protection fining guidance in March 2024, and this framework continues to shape 2026 penalties. The calculation follows a five-step process:

1. Assess seriousness of the infringement (low, medium, or high).
2. Determine starting point based on the organisation's turnover.
3. Adjust for aggravating or mitigating factors such as previous breaches, cooperation with the ICO, or steps taken to remedy harm.
4. Consider deterrent effect to ensure the fine is effective and proportionate.
5. Apply the statutory maximum cap where necessary.

Aggravating factors that have pushed 2026 fines higher include failure to notify the ICO within 72 hours, lack of a Data Protection Officer where legally required, and evidence of prior warnings ignored.

Common Breaches That Led to 2026 Fines

Weak Access Controls

Missing multi-factor authentication, shared administrator accounts, and stale user permissions have featured in nearly every major 2026 case. The ICO now treats MFA as a baseline expectation for any system holding personal data.

Unencrypted Data at Rest and in Transit

Cloud misconfiguration, unencrypted email attachments, and lost devices without full-disk encryption remain top causes of enforcement.

Excessive Data Retention

Storing personal data "just in case" beyond documented retention periods violates the storage limitation principle. Several 2026 fines targeted organisations that could not justify why they still held decade-old customer records.

Marketing Without Consent

PECR violations — unsolicited calls, texts, and emails — accounted for the highest number of 2026 penalties by volume, even if not by monetary value.

How Businesses Can Avoid ICO Fines

Compliance is not a one-off exercise. It requires ongoing governance, technical investment, and staff awareness. Here is a practical checklist based on the failings the ICO has cited most often in 2026.

Pros of a Proactive Compliance Programme

• Significant reduction in breach likelihood and severity
• Faster incident response minimises regulatory exposure
• Increased customer trust and competitive differentiation
• Mitigating factor in any ICO investigation, potentially reducing fines

Cons of Ignoring Compliance

• Fines up to £17.5 million or 4% of global turnover
• Reputational damage that can persist for years
• Potential civil claims from affected data subjects
• Personal liability risks for senior officers under certain regulations

Practical Steps to Take Now

1. Map your data flows. You cannot protect what you don't know you hold.
2. Conduct a gap analysis against UK GDPR Articles 5, 6, 9, 25, and 32.
3. Implement MFA everywhere and encrypt all personal data at rest.
4. Review your cookie consent mechanism against ICO guidance.
5. Test your incident response plan at least twice a year with realistic scenarios.
6. Train staff quarterly on phishing, data handling, and breach reporting.
7. Audit third-party processors — you remain responsible for their compliance.

Protecting Shared Links and Marketing URLs

An often-overlooked compliance area is how organisations share links containing personal data or track marketing campaigns. Unbranded, opaque redirect chains can confuse users about who is processing their data, while poorly configured link trackers can inadvertently leak personal identifiers.

Using a reputable, privacy-conscious link management platform helps demonstrate accountability under Article 5(2). Services like Lunyb allow you to create branded short links with transparent redirect behaviour and controlled analytics, reducing the risk that your marketing operations become a source of unintended data leakage. For a broader look at how link management fits into a compliant marketing stack, see our 2026 buyer's guide to URL shorteners.

What Happens During an ICO Investigation?

Understanding the enforcement process helps organisations respond effectively if the ICO comes knocking.

1. Initial contact: Usually a formal letter requesting information, following a breach report or complaint.
2. Information notice: A legally binding request for documents and evidence.
3. Assessment: The ICO evaluates whether an infringement has occurred and its severity.
4. Notice of intent: If a fine is proposed, you receive detailed reasoning and a chance to make written representations.
5. Final penalty notice: The ICO's final decision, which can be appealed to the First-tier Tribunal within 28 days.

Cooperation throughout this process is critical. Organisations that engage constructively, provide requested information promptly, and demonstrate remedial action have seen fines reduced substantially in 2026.

Looking Ahead: What to Expect from the ICO in Late 2026 and 2027

The ICO's three-year strategic plan (ICO25) evolved into ICO27 in early 2026, with a stated focus on children's data, AI accountability, and biometric technologies. Expect enforcement to intensify in these areas, particularly around:

• AI systems processing personal data without valid lawful basis
• Age-assurance failures on social and gaming platforms
• Facial recognition deployment in retail and public spaces
• Data broker practices under the new Data (Use and Access) Act 2025

Organisations deploying generative AI tools trained on customer data should treat this as a priority risk area heading into 2027.

Frequently Asked Questions

What is the largest ICO fine ever issued?

The largest ICO fine remains the £20 million issued to British Airways in 2020 (reduced from an initial £183 million proposal) for the 2018 data breach. In 2026, the largest fine to date is the £6.09 million against Advanced Computer Software Group.

Can the ICO fine individuals or only companies?

The ICO primarily fines organisations, but it can also prosecute individuals under Section 170 of the Data Protection Act 2018 for offences like unlawfully obtaining personal data. Directors and senior officers can face personal liability in specific circumstances, including PECR breaches.

How long do I have to report a data breach to the ICO?

Data controllers must report notifiable personal data breaches to the ICO within 72 hours of becoming aware of them. Failure to notify on time is itself a breach that can attract separate penalties.

Do ICO fines apply to small businesses?

Yes. While the ICO considers proportionality and typically applies smaller starting points for lower-turnover organisations, small businesses are not exempt from UK GDPR or PECR. Sole traders have been fined under PECR for nuisance marketing in 2026.

Can an ICO fine be appealed?

Yes. Organisations can appeal a monetary penalty notice to the First-tier Tribunal (General Regulatory Chamber) within 28 days of issue. Several high-profile ICO fines have been reduced or overturned on appeal, so seeking specialist legal advice is essential.

Final Thoughts

The 2026 ICO fines demonstrate that UK data protection enforcement is neither theoretical nor selective. Organisations of every size — from healthcare providers to gambling operators to government departments — have felt the weight of regulatory action this year. The common thread is preventable failure: missing MFA, unencrypted data, ignored consent rules, and slow breach response.

Investing in solid data governance is no longer optional. Whether you are reviewing your marketing consent, tightening access controls, or auditing your suppliers, the cost of prevention is a fraction of the cost of an ICO penalty — not to mention the reputational damage that lingers long after the fine is paid.